Event ID: 3002

  • Article

Applies To: Forefront Endpoint Protection

Event ID 3002 — Endpoint Protection Client

This event is logged in the System log.

Details

Product

Microsoft Malware Protection

ID

3002

Source

Microsoft Antimalware

Version

3.0

Symbolic Name

MALWAREPROTECTION_RTP_AGENT_FAILURE

Message

Endpoint Protection client Real-Time Protection feature has encountered an error and failed.

  • Feature: On Access, IE Downloads and Outlook Express Attachments, Behavior monitoring, Information protection control, Network Inspection System

  • Error Code: <Error code>

  • Error description: <Error description>

Explanation

The Endpoint Protection client’s real-time protection feature encountered an error because one of the services failed to start.

User Action

To troubleshoot this event, use the following steps:

  1. Try to restart both services.

    1. At an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the Antimalware engine.

    2. At an elevated command prompt, type net stop nissrv, then type net start nissrv to restart the NIS engine by using the NiSSRV.exe file.

  2. If it fails in the same way, look up the error code by accessing the Microsoft Support site (https://go.microsoft.com/fwlink/?LinkId=215163) and entering the error number in the Search box or contact Microsoft Technical Support (//go.microsoft.com/fwlink/?LinkId=215491).